Vulnerability in Wp Roster

CVE-2026-115257

The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.

Published .

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

  • Wp Roster

References